My homelab K3s cluster originally used Kubernetes Ingress objects with NGINX, then I switched the Ingress resources to use Traefik. The Ingresses still had cert-manager annotations, and later I replaced them entirely with Traefik IngressRoute resources. I expected the cert-manager Certificate objects to be deleted automatically when their owning Ingresses were removed, but the Certificates—and their TLS Secrets—still exist. This is convenient, but I'm unsure why it happened and currently don't have manifest files to recreate the Certificates if the cluster is lost. I plan to export proper Certificate manifests, but what explains their survival?
2 Answers
Check each Certificate’s `metadata.ownerReferences`. Kubernetes only performs cascading garbage collection when that ownership relationship is still active. Also inspect `deletionTimestamp` and `finalizers` to see whether deletion was attempted but became stuck. If the Ingress was deleted with orphan propagation, its dependents would have been retained and the ownership reference removed. For backup manifests, keep the Certificate name, namespace, and intended `spec`, but remove `status`, UIDs, resource versions, timestamps, and old Ingress owner references.
An IngressRoute does not automatically replace or inherit the ownership relationship from an old Ingress. cert-manager may have created the Certificate from the original Ingress, but the new Traefik route is a separate API object and does not explain why the Certificate remains. If the old Ingress was deleted using orphan propagation or another tool removed its ownership relationship, the Certificate would remain as an independent resource.
That seems to be what happened here: the Certificates were originally generated from the old Ingresses, but they have no relationship with the newer IngressRoute objects, so they appear to be orphaned.
The Certificates still list the deleted Ingress objects in their owner references, including the old UIDs. They have no deletion timestamps or finalizers, so they appear to have simply been left orphaned.